There is an increasing demand for additional security features for controlling access to data communications networks. This is due, in large part, to an increase in the use of portable computing devices such as laptop computers and Voice Over Internet Protocol (VoIP) telephones, which can be easily moved from one point of network access to another. While such ease of access may be desirable from an end user perspective, it creates significant concerns from the perspective of network security.
For wired networks, recent security solutions from network vendors have involved pushing authentication functions out to the layer 2 port, such as to a layer 2 switch. One such solution involves authenticating the physical, or Media Access Control (MAC), address of a device coupled to the port of a layer 2 switch. Another solution involves enabling the switch to perform user authentication in accordance with protocols defined by the IEEE 802.1x standard. A further solution builds on the 802.1x protocol to dynamically assign an Access Control List (“ACL”) or a MAC address filter to a port of a network switch based on the identity of a user. However, a majority of conventional switches do not provide the ability to implement all of these security features in a single network device.
A product marketed by Cisco Systems, Inc. of San Jose, Calif., designated the Catalyst 3550 Multilayer Switch, apparently provides a combination of the foregoing security features. However, the combination of physical (MAC) address authentication and 802.1x authentication is only provided in a multiple host (“multi-host”) configuration, in which one or more computing devices are coupled to a single port of the switch via a central computing device. Furthermore, the 802.1x authentication is always performed prior to physical (MAC) address authentication in the Cisco product. Thus, when a computing device is coupled to a port of the Cisco switch, local resources (e.g., switch resources necessary to perform 802.1x authentication and, optionally, dynamic ACL and/or MAC address filter assignment) as well as network resources (e.g., communication between the switch and an authentication server) will always be expended to authenticate the user, prior to determining whether or not the physical (MAC) address of the device is valid. This results in a waste of such resources in the case where the device has an unauthorized MAC address.
What is needed then is a security solution that improves upon and addresses the shortcomings of known security solutions.